PDF malware analysis — malicious · c16da62a450b3a45

MALICIOUS

PDF

101.3 KB Created: 2021-03-26 09:27:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22

MD5: 327fd4ab8702eb4bcab1c21ae80796f1 SHA-1: d4c5956d337baf53c556d3bfd5c50063a35be006 SHA-256: c16da62a450b3a45ce15bbbf95237f6466089847e6492df114346c528fea6b70

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and is flagged by multiple heuristics as malicious, including ML and ClamAV detections. The primary malicious URL, 'https://fokemale.ru/award?keyword=surah+yaseen+pdf+with+urdu+translation', suggests a phishing or scam attempt disguised as a search result. The document body, though heavily obfuscated, contains metadata indicating it was generated by wkhtmltopdf, a tool often used to create malicious PDFs.

Machine Learning

Nyx PDF Classifier malicious score 0.9425

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://fokemale.ru/award?keyword=surah+yaseen+pdf+with+urdu+translation PDF link annotation
- http://letabumo.getenjoyment.net/we_are_all_born_free_book.pdfIn PDF document text
- http://regse.website/98923257468zqx7d.pdfIn PDF document text
- http://baltika-trans.ru/wapwon_mp3_status_downloads2w8x.pdfIn PDF document text
- https://cdn.sqhk.co/mafowixodi/Aeia819/88950936910.pdfIn PDF document text
- http://cosmosqrab.online/how_to_get_sim_card_out_of_alcatel_flip_phoneqokhr.pdfIn PDF document text
- http://pusatokolerax.mywebcommunity.org/azorin_biografia.pdfIn PDF document text
- https://cdn.sqhk.co/rixakowu/gjjcie8/wivasadijizaza.pdfIn PDF document text
- http://zeretula.iblogger.org/nisobezifut.pdfIn PDF document text
- https://cdn.sqhk.co/fapolokid/c8iftXk/1192994216.pdfIn PDF document text
- https://cdn.sqhk.co/lenufetimop/2WRjchd/adventure_island_mini_golf_closing_times.pdfIn PDF document text
- https://cdn.sqhk.co/xijisejes/jijgn8E/77510480379.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/adfe3215-1a11-44d9-88a6-b21d6e8092ae/14640060829.pdfIn PDF document text
- http://suremamivag.epizy.com/ruguludagibeselopeve.pdfIn PDF document text
- https://s3.amazonaws.com/fikuvine/7456567341.pdfIn PDF document text
- http://dovovefuwaxav.epizy.com/47693299022.pdfIn PDF document text
- http://moduvodaw.epizy.com/horus_heresy_book_nine_crusade.pdfIn PDF document text
- https://s3.amazonaws.com/lusegokaves/58719809120.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d5b0cc5d-7ca8-4009-be24-512c900a521c/bineb.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3eda4a0e-7642-4101-b724-4fe5ffb52b61/xopavewoxapaxamof.pdfIn PDF document text
- http://fabonejane.onlinewebshop.net/12121255749.pdfIn PDF document text
- http://sezajuvijib.rf.gd/academy_stars_3_teacher_s_book.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.